Evaluation Study on Network Traffic Analysis-Based Tools in Intrusions Detection

Abstract

Network operators and network service providers are increasingly interested in network traffic analysis over the past decade, and network traffic analysis is a method of examining data as it flows through the network. In other words, network traffic analysis is a procedure carried out by the network administration to examine the data belonging to the network users for the purpose of analyzing it, dealing with network congestion, perform statistical

operations, monitor user behavior and detect attacks. To prevent sabotage, network traffic analysis has been employed in intrusion detection systems, which rely on network traffic analysis first, and secondly, searching for indicators and evidence of intrusions, one of which may be the search for abnormal network traffic patterns for known patterns.

Detecting indicators of an attack is not an easy task, and it becomes more difficult with modern applications such as social media applications that care about privacy and maintain the confidentiality of transmitted data, and the presence of covert channels that allow data leakage, which may include malicious software, which is often ignored by well-known intrusion detection systems. As a result, studying network traffic analysis tools and evaluating the effectiveness and performance of intrusion detection systems are important for network operators as a first step in choosing the appropriate system, and subsequently developing their existing system.

In this research, a study of some network traffic analysis tools such as: TCPDump and Wireshark, and an evaluation of the two intrusion detection systems: Snort and Suricata in terms of: detect various attacks targeting the confidentiality, integrity and availability of data and computer resources including covert channels attacks; load balancing on processing cores; consumption of computer resources; the ability of detection systems to receive and process network packets, and drop network packets and alerts; in addition to studying the possibility of improving these systems